What causes "missing `auth_tokens` section" in kgretzky/evilginx2?

Add an `auth_tokens` section to the phishlet (use `auth_tokens: []` if truly none needed)

missing `auth_tokens` section

Error message

missing `auth_tokens` section

What it means

Same validation pass as the proxy_hosts check: the parser requires the `auth_tokens` section to exist. A nil AuthTokens section means no cookie/token capture rules are defined, so the phishlet is rejected. It is raised immediately after the proxy_hosts check in LoadPhishlet.

Source

Thrown at core/phishlet.go:381

				p.customParams[param.Name] = val
			}
		}

		/*
			if customParams != nil {
				p.customParams = *customParams
			} else {
				for _, param := range *fp.Params {
					p.customParams[param.Name] = param.Default
				}
			}*/
	}

	if fp.ProxyHosts == nil {
		return fmt.Errorf("missing `proxy_hosts` section")
	}
	if fp.AuthTokens == nil {
		return fmt.Errorf("missing `auth_tokens` section")
	}
	if fp.Credentials == nil {
		return fmt.Errorf("missing `credentials` section")
	}
	if fp.Credentials.Username == nil {
		return fmt.Errorf("credentials: missing `username` section")
	}
	if fp.Credentials.Password == nil {
		return fmt.Errorf("credentials: missing `password` section")
	}
	if fp.LoginItem == nil {
		return fmt.Errorf("missing `login` section")
	}

	for _, ph := range *fp.ProxyHosts {
		if ph.PhishSub == nil {
			return fmt.Errorf("proxy_hosts: missing `phish_sub` field")
		}

View on GitHub (pinned to 4c0988a1d9)

Solutions

Add an `auth_tokens` section to the phishlet (use `auth_tokens: []` if truly none needed)
Fix spelling to exactly `auth_tokens` and ensure it is a top-level key
Check indentation so the section isn't nested under another key
Copy the section layout from an official phishlet in phishlets/ as a template

Example fix

# before
credentials:
  username: {...}
# after (add missing section)
auth_tokens:
  - domain: '.example.com'
    keys: ['SessionID', 'session']
credentials:
  username: {...}

Defensive patterns

Strategy: validation

Validate before calling

doc := map[string]interface{}{}
yaml.Unmarshal(data, &doc)
if _, ok := doc["auth_tokens"]; !ok {
    return fmt.Errorf("phishlet must define auth_tokens (use [] if empty)")
}

Type guard

func hasAuthTokens(fp *ConfigPhishlet) bool {
    return fp.AuthTokens != nil
}

Try / catch

if err := cfg.LoadPhishlet(name, path, nil); err != nil {
    if strings.Contains(err.Error(), "missing `auth_tokens`") {
        log.Error("add an auth_tokens section (auth_tokens: [] suffices) to %s", path)
    }
}

Prevention

Always include auth_tokens even if the list is empty — the key must exist
Verify the key spelling: auth_tokens (plural), top-level
Diff hand-edited phishlets against an official one to spot dropped sections
Validate with a YAML linter after every manual edit

When it happens

Trigger: Loading a phishlet YAML missing the top-level `auth_tokens:` key — either omitted, commented out, misspelled (e.g. `auth_token:`), or mis-indented so it unmarshals as nil even though other sections pass.

Common situations: Minimal/hand-made phishlets that include proxy_hosts and credentials but skip auth_tokens, or YAML indentation errors silently dropping the section (note: an empty `auth_tokens: []` list is fine — the key must exist).

Related errors

AI-assisted analysis of kgretzky/evilginx2@4c0988a1d9 (2026-09-05). Data as JSON: /api/errors/733241245fd2d88b. Report an issue: GitHub.